Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
37

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
140
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
89
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
67
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
100
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
71
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
0
51
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.5k

Other Decks in Technology

See All in Technology
シンプルな設定ファイルで実現する AWS IAM Identity Center のユーザー管理と開発チームへの委譲 / Delegating AWS IAM Identity Center User Management with a Simple DSL
Avatar for Takashi Yamaguchi yamaguchitk333
3
560
2025advance01
Avatar for minamizaki minamizaki
0
130
プラットフォームとしての Datadog / Datadog as Platforms
Avatar for Kento Kimura aoto
PRO
1
330
研究開発部メンバーの働き⽅ / Sansan R&D Profile
Avatar for Sansan, Inc. sansan33
PRO
3
17k
いまさら聞けない Git 超入門 〜Gitって結局なに？から始める第一歩〜
Avatar for とことんDevOps devops_vtj
0
150
GitHub Coding Agent 概要
Avatar for KAMEGAWA Kazushi kkamegawa
1
1.5k
Cloud Run を解剖して コンテナ監視を考える / Breaking Down Cloud Run to Rethink Container Monitoring
Avatar for Kento Kimura aoto
PRO
0
110
What's Next in OpenShift Q2 CY2025
Avatar for Red Hat Livestreaming redhatlivestreaming
1
690
ゴリラ.vim #36 ~ Vim x SNS ~ スポンサーセッション
Avatar for yasunori yasunori0418
1
320
Redmineの意外と知らない便利機能 （Redmine 6.0対応版）
Avatar for MAEDA Go vividtone
0
1.1k
オープンソースのハードウェアのコンテストに参加している話
Avatar for misoji engineer iotengineer22
0
510
ソフトウェアテストのAI活用_ver1.10
Avatar for fumisuke fumisuke
0
220

Featured

See All Featured
Being A Developer After 40
Avatar for Adrian Kosmaczewski akosma
91
590k
Speed Design
Avatar for Sergey Chernyshev sergeychernyshev
30
970
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
8
750
Side Projects
Avatar for Sacha Greif sachag
454
42k
Put a Button on it: Removing Barriers to Going Fast.
Avatar for kastner kastner
60
3.9k
Thoughts on Productivity
Avatar for Jon Yablonski jonyablonski
69
4.7k
BBQ
Avatar for Matthew Crist matthewcrist
88
9.7k
Easily Structure & Communicate Ideas using Wireframe
Avatar for Afnizar Nur Ghifari afnizarnur
194
16k
Practical Orchestrator
Avatar for Shlomi Noach shlominoach
188
11k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
55
5.6k
Product Roadmaps are Hard
Avatar for C. Todd Lombardo iamctodd
PRO
53
11k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
507
140k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and